Appendix B Configuration Profile Format 81 Wi-Fi Payload The Wi-Fi payload is designated by the com.apple.wifi.managed PayloadType value. This describes version 0 of the PayloadVersion value. In addition to the settings common to all payload types, the payload defines the following keys. For 802.1X enterprise networks, the EAP Client Configuration Dictionary must be provided. PayloadCertificateUUID String. The UUID of the certificate to use for the account credentials. Only present if AuthenticationMethod = Certificate. Used for Cisco IPSec. PromptForVPNPIN Boolean. Whether to prompt for a PIN when connecting. Used for Cisco IPSec. Key Value Key Value SSID_STR String. SSID of the Wi-Fi network to be used. HIDDEN_NETWORK Boolean. Besides SSID, the device uses information such as broadcast type and encryption type to differentiate a network. By default, it’s assumed that all configured networks are open or broadcast. To specify a hidden network, you need to include a boolean for the key “HIDDEN_NETWORK”. EncryptionType String. The possible values for “EncryptionType” are “WEP”, “WPA”, or “Any”. “WPA” corresponds to WPA and WPA2 and applies to both encryption types. Make sure that these values exactly match the capabilities of the network access point. If you’re unsure about the encryption type, or would prefer that it applies to all encryption types, use the value “Any”. Password String, optional. The absence of a password doesn’t prevent the network from being added to the list of known networks. The user is eventually prompted to provide the password when connecting to that network. 82 Appendix B Configuration Profile Format EAPClientConfiguration Dictionary In addition to the standard encryption types, it’s possible to specify an enterprise profile for a given network via the “EAPClientConfiguration” key. If present, its value is a dictionary with the following keys. Key Value UserName String, optional. Unless you know the exact user name, this property won’t appear in an imported configuration. Users can enter this information when they authenticate. AcceptEAPTypes Array of integer values. These EAP types are accepted: 13 = TLS 17 = LEAP 21 = TTLS 25 = PEAP 43 = EAP-FAST PayloadCertificateAnchorUUID Array of strings, optional. Identifies the certificates to be trusted for this authentication. Each entry must contain the UUID of a certificate payload. Use this key to prevent the device from asking the user if the listed certificates are trusted. Dynamic trust (the certificate dialogue) is disabled if this property is specified, unless TLSAllowTrustExceptions is also specified with the value true. TLSTrustedServerNames Array of string values, optional. This is the list of server certificate common names that will be accepted. You can use wildcards to specify the name, such as wpa.*.example.com. If a server presents a certificate that isn’t in this list, it won’t be trusted. Used alone or in combination with TLSTrustedCertificates, the property allows someone to carefully craft which certificates to trust for the given network, and avoid dynamically trusted certificates. Dynamic trust (the certificate dialogue) is disabled if this property is specified, unless TLSAllowTrustExceptions is also specified with the value true. TLSAllowTrustExceptions Boolean, optional. Allows/disallows a dynamic trust decision by the user. The dynamic trust is the certificate dialogue that appears when a certificate isn’t trusted. If this is false, the authentication fails if the certificate isn’t already trusted. See PayloadCertificateAnchorUUID and TLSTrustedNames above. The default value of this property is true unless either PayloadCertificateAnchorUUID or TLSTrustedServerNames is supplied, in which case the default value is false. Appendix B Configuration Profile Format 83 EAP-Fast Support The EAP-FAST module uses the following properties in the EAPClientConfiguration dictionary. These keys are hierarchical in nature: if EAPFASTUsePAC is false, the other two properties aren’t consulted. Similarly, if EAPFASTProvisionPAC is false, EAPFASTProvisionPACAnonymously isn’t consulted. If EAPFASTUsePAC is false, authentication proceeds much like PEAP or TTLS: the server proves its identity using a certificate each time. If EAPFASTUsePAC is true, then an existing PAC is used if it’s present. The only way to get a PAC on the device currently is to allow PAC provisioning. So, you need to enable EAPFASTProvisionPAC, and if desired, EAPFASTProvisionPACAnonymously. EAPFASTProvisionPACAnonymously has a security weakness: it doesn’t authenticate the server so connections are vulnerable to a man-in-the-middle attack. Certificates As with VPN configurations, it’s possible to associate a certificate identity configuration with a Wi-Fi configuration. This is useful when defining credentials for a secure enterprise network. To associate an identity, specify its payload UUID via the “PayloadCertificateUUID” key. TTLSInnerAuthentication String, optional. This is the inner authentication used by the TTLS module. The default value is “MSCHAPv2”. Possible values are “PAP”, “CHAP”, “MSCHAP”, and “MSCHAPv2”. OuterIdentity String, optional. This key is only relevant to TTLS, PEAP, and EAP- FAST. This allows the user to hide his or her identity. The user’s actual name appears only inside the encrypted tunnel. For example, it could be set to “anonymous” or “anon”, or “anon@mycompany.net”. It can increase security because an attacker can’t see the authenticating user’s name in the clear. Key Value Key Value EAPFASTUsePAC Boolean, optional. EAPFASTProvisionPAC Boolean, optional. EAPFASTProvisionPACAnonymously Boolean, optional. Key Value PayloadCertificateUUID String. UUID of the certificate payload to use for the identity credential. 84 Appendix B Configuration Profile Format Sample Configuration Profiles This section includes sample profiles that illustrate the over-the-air enrollment and configuration phases. These are excerpts and your requirements will vary from the examples. For syntax assistance, see the details provided earlier in this appendix. For a description of each phase, see “Over-the-Air Enrollment and Configuration” on page 22. Sample Phase 1 Server Response <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple Inc//DTD PLIST 1.0//EN" "http:// www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>PayloadContent</key> <dict> <key>URL</key> <string>https://profileserver.example.com/iphone</string> <key>DeviceAttributes</key> <array> <string>UDID</string> <string>IMEI</string> <string>ICCID</string> <string>VERSION</string> <string>PRODUCT</string> </array> <key>Challenge</key> <string>optional challenge</string> or <data>base64-encoded</data> </dict> <key>PayloadOrganization</key> <string>Example Inc.</string> <key>PayloadDisplayName</key> <string>Profile Service</string> <key>PayloadVersion</key> <integer>1</integer> <key>PayloadUUID</key> <string>fdb376e5-b5bb-4d8c-829e-e90865f990c9</string> <key>PayloadIdentifier</key> <string>com.example.mobileconfig.profile-service</string> <key>PayloadDescription</key> <string>Enter device into the Example Inc encrypted profile service</ string> <key>PayloadType</key> <string>Profile Service</string> </dict> </plist> Appendix B Configuration Profile Format 85 Sample Phase 2 Device Response <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/ DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>UDID</key> <string></string> <key>VERSION</key> <string>7A182</string> <key>MAC_ADDRESS_EN0</key> <string>00:00:00:00:00:00</string> <key>CHALLENGE</key> either: <string>String</string> or: <data>"base64 encoded data"</data> </dict> </plist> Sample Phase 3 Server Response With SCEP Specifications <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple Inc//DTD PLIST 1.0//EN" "http:// www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>PayloadVersion</key> <integer>1</integer> <key>PayloadUUID</key> <string>Ignored</string> <key>PayloadType</key> <string>Configuration</string> <key>PayloadIdentifier</key> <string>Ignored</string> <key>PayloadContent</key> <array> <dict> <key>PayloadContent</key> <dict> <key>URL</key> <string>https://scep.example.com/scep</string> <key>Name</key> <string>EnrollmentCAInstance</string> <key>Subject</key> <array> <array> 86 Appendix B Configuration Profile Format <array> <string>O</string> <string>Example, Inc.</string> </array> </array> <array> <array> <string>CN</string> <string>User Device Cert</string> </array> </array> </array> <key>Challenge</key> <string> </string> <key>Keysize</key> <integer>1024</integer> <key>Key Type</key> <string>RSA</string> <key>Key Usage</key> <integer>5</integer> </dict> <key>PayloadDescription</key> <string>Provides device encryption identity</string> <key>PayloadUUID</key> <string>fd8a6b9e-0fed-406f-9571-8ec98722b713</string> <key>PayloadType</key> <string>com.apple.security.scep</string> <key>PayloadDisplayName</key> <string>Encryption Identity</string> <key>PayloadVersion</key> <integer>1</integer> <key>PayloadOrganization</key> <string>Example, Inc.</string> <key>PayloadIdentifier</key> <string>com.example.profileservice.scep</string> </dict> </array> </dict> </plist> Appendix B Configuration Profile Format 87 Sample Phase 4 Device Response <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/ DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>UDID</key> <string></string> <key>VERSION</key> <string>7A182</string> <key>MAC_ADDRESS_EN0</key> <string>00:00:00:00:00:00</string> </dict> </plist> 88 Appendix C C Sample Scripts This appendix provides sample scripts for iPhone OS deployment tasks. The scripts in this section should be modified to fit your needs and configurations. Sample C# Script for iPhone Configuration Utility This sample script demonstrates creating configuration files using iPhone Configuration Utility for Windows. using System; using Com.Apple.iPCUScripting; public class TestScript : IScript { private IApplication _host; public TestScript() { } public void main(IApplication inHost) { _host = inHost; string msg = string.Format("# of config profiles : {0}", _host.ConfigurationProfiles.Count); Console.WriteLine(msg); IConfigurationProfile profile = _host.AddConfigurationProfile(); profile.Name = "Profile Via Script"; profile.Identifier = "com.example.configviascript"; profile.Organization = "Example Org"; profile.Description = "This is a configuration profile created via the new scripting feature in iPCU"; // passcode IPasscodePayload passcodePayload = profile.AddPasscodePayload(); passcodePayload.PasscodeRequired = true; Appendix C Sample Scripts 89 passcodePayload.AllowSimple = true; // restrictions IRestrictionsPayload restrictionsPayload = profile.AddRestrictionsPayload(); restrictionsPayload.AllowYouTube = false; // wi-fi IWiFiPayload wifiPayload = profile.AddWiFiPayload(); wifiPayload.ServiceSetIdentifier = "Example Wi-Fi"; wifiPayload.EncryptionType = WirelessEncryptionType.WPA; wifiPayload.Password = "password"; wifiPayload = profile.AddWiFiPayload(); profile.RemoveWiFiPayload(wifiPayload); // vpn IVPNPayload vpnPayload = profile.AddVPNPayload(); vpnPayload.ConnectionName = "Example VPN Connection"; vpnPayload = profile.AddVPNPayload(); profile.RemoveVPNPayload(vpnPayload); // email IEmailPayload emailPayload = profile.AddEmailPayload(); emailPayload.AccountDescription = "Email Account 1 Via Scripting"; emailPayload = profile.AddEmailPayload(); emailPayload.AccountDescription = "Email Account 2 Via Scripting"; // exchange IExchangePayload exchangePayload = profile.AddExchangePayload(); exchangePayload.AccountName = "ExchangePayloadAccount"; // ldap ILDAPPayload ldapPayload = profile.AddLDAPPayload(); ldapPayload.Description = "LDAP Account 1 Via Scripting"; ldapPayload = profile.AddLDAPPayload(); ldapPayload.Description = "LDAP Account 2 Via Scripting"; // webclip IWebClipPayload wcPayload = profile.AddWebClipPayload(); wcPayload.Label = "Web Clip 1 Via Scripting"; wcPayload = profile.AddWebClipPayload(); wcPayload.Label = "Web Clip 2 Via Scripting"; } } 90 Appendix C Sample Scripts Sample AppleScript for iPhone Configuration Utility This sample script demonstrates creating configuration files using iPhone Configuration Utility for Mac OS X. tell application "iPhone Configuration Utility" log (count of every configuration profile) set theProfile to make new configuration profile with properties {displayed name:"Profile Via Script", profile identifier:"com.example.configviascript", organization:"Example Org.", account description:"This is a configuration profile created via AppleScript"} tell theProfile make new passcode payload with properties {passcode required:true, simple value allowed:true} make new restrictions payload with properties {YouTube allowed:false} make new WiFi payload with properties {service set identifier:"Example Wi-Fi", security type:WPA, password:"password"} set theWiFiPayload to make new WiFi payload delete theWiFiPayload make new VPN payload with properties {connection name:"Example VPN Connection"} set theVPNPayload to make new VPN payload delete theVPNPayload make new email payload with properties {account description:"Email Account 1 Via Scripting"} make new email payload with properties {account description:"Email Account 2 Via Scripting"} make new Exchange ActiveSync payload with properties {account name:"ExchangePayloadAccount"} make new LDAP payload with properties {account description:"LDAP Account 1 Via Scripting"} make new LDAP payload with properties {account description:"LDAP Account 2 Via Scripting"} make new web clip payload with properties {label:"Web Clip Account 1 Via Scripting"} make new web clip payload with properties {label:"Web Clip Account 2 Via Scripting"} end tell end tell . <integer>1</integer> <key>PayloadUUID</key> <string>fdb376e5-b5bb-4d8c-829e-e90865f 990 c9</string> <key>PayloadIdentifier</key> <string>com.example.mobileconfig.profile-service</string> . inHost) { _host = inHost; string msg = string.Format("# of config profiles : {0}", _host.ConfigurationProfiles.Count); Console.WriteLine(msg); IConfigurationProfile profile = _host.AddConfigurationProfile(); profile.Name. provides sample scripts for iPhone OS deployment tasks. The scripts in this section should be modified to fit your needs and configurations. Sample C# Script for iPhone Configuration Utility This